pam-afs-session To-Do List

PAM API:

 * Tighter verification that all of our flags are valid might be a good
   idea.

Configuration:

 * Consider defaulting to nopag on Mac OS X and any other platform where
   we know PAGs cannot be supported.